What Is LiveContainer? Unlimited Sideloading with SideStore
LiveContainer is a single sideloaded app that runs other apps inside itself. Only LiveContainer holds a signature; everything you load into it rides along on that one slot. That is the whole idea, and it is why people run ten or twenty sideloaded apps on a free Apple ID that officially allows three.
It works. It is also a stack of moving parts with a weekly chore attached. Here is what each piece does, what the setup actually looks like in 2026, and the failures that show up on forums week after week.
Why the three-app limit exists
A free Apple ID can sign three apps at a time, and each signature lasts seven days. Those two numbers shape every free sideloading method — AltStore, SideStore, Sideloadly all live inside them.
LiveContainer does not remove the limit. It sidesteps it: your three slots hold LiveContainer itself (plus whatever else you want outside it), and the apps you actually use live inside the container, invisible to Apple’s count.
The stack: SideStore, a local VPN, LiveContainer
Three pieces, each solving the problem the previous one creates.
SideStore is a fork of AltStore that does not need AltServer running on a computer. It signs and installs apps on the device itself.
A local VPN is what makes wireless refresh possible — it spoofs the connection SideStore expects from an AltServer, so re-signing happens over Wi-Fi instead of a cable. As of 2026 there are three in circulation: StikDebug (the most reliable, via AltStore PAL in the EU or direct download), LocalDevVPN (newer, works on iOS 26), and StosVPN (the original, pulled from the App Store — still works if you already have it).
LiveContainer is the part that breaks the app cap, as described above. It offers JIT and JIT-less modes; JIT-less is what most people use, because it signs guest apps with LiveContainer’s own certificate and does not need a debugger attached. Note that on iOS 26 the JIT story changed — it is no longer a general capability you unlock once, so it works only where a developer added explicit support (the details are here).
How the setup goes
The common route is the bundled build — a version of LiveContainer with SideStore baked in:
- Sideload the bundle once, using a loader and your free Apple ID.
- Install a VPN from the list above and point SideStore at it for wireless refresh.
- Enable JIT-less mode inside LiveContainer so guest apps get signed.
- Add your IPAs into LiveContainer and launch them from Home Screen shortcuts.
Done carefully, you end up with a phone full of sideloaded apps and no cable in sight.
The seven-day refresh still applies
The free certificate is valid for seven days. When LiveContainer’s signature expires, nothing inside it launches until you refresh — open SideStore, find LiveContainer, re-sign it before the timer runs out. Miss the window and you redo part of the setup.
The container multiplies how many apps one slot carries. It does nothing about the clock.
What actually goes wrong
These are the failures that repeat across forum threads, not edge cases:
- Installation hangs. LiveContainer sticks mid-install in SideStore. The community fix is to retry repeatedly or switch to a nightly build.
- The VPN disappears. StosVPN was pulled from the App Store; StikDebug is not reachable everywhere. Getting a VPN can require the sideloading setup you are trying to finish — a chicken-and-egg problem.
- Pairing files go stale. They break without an obvious cause, and regenerating one needs computer access again.
- JIT-less import fails. “The certificate is not valid” on importing from SideStore — required for guest apps to run, and awkward to diagnose.
- Auto-refresh is unreliable. The Shortcuts-based routine fails for some devices with “SideStore could not determine this device’s UDID”.
What not to do
- Don’t block Apple’s servers by DNS. Old guides recommended it; SideStore does not need it, and the DNS slot is better spent on ad blocking.
- Don’t delete expired apps. If something shows “no longer available”, refresh it — deleting takes the app data with it.
- Don’t share your pairing file. It carries your device UDID.
- Don’t expect push notifications inside the container. Virtualized guest apps do not get them; an app that needs notifications has to sit in its own slot outside LiveContainer.
LiveContainer FAQ
What is LiveContainer?
A virtual environment that runs sideloaded apps inside one signed app, so a free Apple ID’s three-app limit stops being the ceiling. No jailbreak involved.
How does LiveContainer work?
Guest apps run inside LiveContainer’s own space rather than being installed separately, so only the container needs a signature. JIT-less mode signs those guest apps with the container’s certificate.
What are the limitations of LiveContainer?
One guest app runs at a time. Not every IPA is compatible. Guest apps do not inherit entitlements, do not get push notifications, and are not sandboxed from each other.
Why pair it with SideStore?
SideStore installs and re-signs LiveContainer on-device, without a computer in the loop after setup. It is the piece that keeps the container alive from week to week.
Where builds.io changes the math
The stack above exists to work around two constraints of a free Apple ID. Managed signing removes the constraints instead of routing around them:
- No three-app limit, so nothing needs to run inside a container — apps install normally, with notifications intact.
- No seven-day refresh and no VPN to keep alive; builds stay signed.
- No computer, ever — you install from Safari in one tap.
It is a subscription, so the honest trade is money for time. One expectation to set: when you first add a device, Apple processes it before apps go live — most are ready within a day, some take up to three. That happens once.
Comparing the free routes instead? See AltStore vs SideStore vs LiveContainer for the head-to-head, every free way to sideload, ranked for the effort-versus-payoff view, and the best IPA signer if you are weighing signing apps that bring their own certificate.